CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-14 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Subtract size of xdp_frame from allowed metadata size The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_run, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom). If userspace supplies such a large metadata size in live packet mode, the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff. The commit in the Fixes tag fixed a related bug where the second check in xdp_update_frame_from_buff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment.

Affected products

Linux kernel: from 5.18 before 6.1.161; from 6.2 before 6.6.121; from 6.7 before 6.12.66; from 6.13 before 6.18.6; 6.19-rc1, 6.19-rc2, 6.19-rc3, 6.19-rc4, 6.19-rc5 — fixed in 6.1.161, 6.12.66, 6.18.6, 6.6.121

How to fix

Upgrade to a fixed version: Linux kernel 6.1.161, 6.12.66, 6.18.6, 6.6.121. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23140 or the next vulnerability affects your stack